Consumer Tech

Apple's Reversal Only Covers Half the Domain Change

Apple reversed the Hide My Email domain move on August 24, 2026, but Sign in with Apple addresses are still migrating to private.icloud.com. Here is what still needs updating.

Consumer TechBy Servola Tech Desk2026-08-254 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Apple's Reversal Only Covers Half the Domain Change

Two Domain Changes, One Reversal

Apple announced in mid-June 2026 that it would move two separate email-relay features onto a single new domain, private.icloud.com: Hide My Email, the iCloud+ feature that generates disposable forwarding addresses, and Sign in with Apple, the login system that hides a user's real email behind a relay address of its own. On 24 August 2026, Apple reversed one half of that plan. In a developer note, Apple said that after further consideration and reviewing feedback from the community, it would not make the change for Hide My Email, and that iCloud+ Hide My Email addresses will remain on icloud.com.

Coverage of the reversal has largely treated it as Apple simply canceling its domain migration. That reading is incomplete. Sign in with Apple was not part of the reversal, and its move to private.icloud.com is still proceeding later in 2026.

Why Blocklisting by Domain Breaks Either Way

The reversal exists because domain-level identification is a blunt instrument. Hide My Email addresses currently share the icloud.com domain with every ordinary iCloud Mail account, so a website cannot block one without risking the other. Moving Hide My Email to its own domain would have fixed that ambiguity for Apple's engineering, but it would have handed every website an easy, reliable way to detect and reject Hide My Email addresses on sight - identifiable by domain, not by any behavior, defeating the feature's purpose for anyone signing up on a site that chooses to discriminate against it.

Feature	Domain after August 2026	Change from original June plan
Hide My Email (new addresses)	icloud.com (unchanged)	Reversed - stays put
Sign in with Apple (new addresses)	private.icloud.com	Proceeding as planned
Sign in with Apple (existing addresses)	privaterelay.appleid.com	Continues forwarding without interruption

Sign in with Apple does not face the same collision risk, because relay addresses for that feature are already visibly distinct from a personal iCloud inbox in most integration flows, which is almost certainly why Apple let that half of the plan continue.

The Part Most Coverage Missed

Sign in with Apple addresses created from now on will carry the new private.icloud.com domain, while every address created before the switch keeps working on privaterelay.appleid.com without interruption, according to Apple's own statement. That is a live migration, not a shelved one, and treating the whole announcement as reversed is the exact kind of mistake that breaks mail delivery for a user months from now.

Any system, anywhere, that was built to recognize Apple's privacy-relay traffic by matching a domain string against a fixed list will start seeing a domain it does not recognize as soon as a user signs up with a freshly created Sign in with Apple address. Nothing about the Hide My Email reversal changes that.

What Site Operators Need to Do Now

Add private.icloud.com to any allowlist, spam filter, fraud rule, or email-validation system that currently checks for privaterelay.appleid.com, and do it before the new domain starts appearing in real signups rather than after support tickets arrive. Leave icloud.com rules exactly as they are; Hide My Email addresses have not moved and will not move under this announcement.

Do not extend the same update to Hide My Email. Because that migration was reversed, a rule written to expect private.icloud.com Hide My Email addresses will simply never match anything, which is harmless, but a rule that still only recognizes the old Sign in with Apple domain will start silently failing on new accounts.

The Broader Lesson for Anti-Abuse Design

The near miss is a clean case study in why domain-based blocking of privacy-relay addresses does not work as a control. Make the relay domain distinct and identifiable, and every operator gets a trivial way to reject privacy-conscious users outright, which is precisely the outcome Apple's own community pushed back against hard enough to reverse a public plan. Keep the relay domain shared with ordinary accounts, and no operator can build a reliable rule against it at all, which is exactly why Sign in with Apple, built as a separate namespace from the start, never had to face this trade-off.

Any team building its own disposable-address or privacy-relay feature is now looking at a real-world example of that trade-off playing out at Apple's scale, decided in public, in under three months.

Frequently asked questions

Did Apple cancel the whole domain change?

No. Only the Hide My Email half was reversed on 24 August 2026. Sign in with Apple addresses are still moving to private.icloud.com later in 2026, and that part of the plan was not affected by the reversal.

Do I need to change anything if I only use Hide My Email?

No action is needed. Hide My Email addresses remain on icloud.com exactly as before; nothing about how those addresses look or work is changing under this announcement.

What breaks if a website's system only recognizes privaterelay.appleid.com?

New Sign in with Apple addresses created after the migration will use private.icloud.com instead. A system that checks only for the old domain will fail to recognize those new addresses as valid Apple relay traffic, even though existing addresses keep working.

Why did Apple reverse Hide My Email but not Sign in with Apple?

Apple said the reversal followed community feedback that a separate, identifiable domain would let websites block Hide My Email addresses on sight. Sign in with Apple relay addresses do not carry the same collision risk with ordinary iCloud Mail accounts, which is likely why that migration continues.

Apple's reversal reads as a full retreat, but it is a half retreat: one privacy feature kept its shared, unblockable domain, and the other is still quietly moving to a new one this year. Systems built to recognize either need to track which half actually changed, not the headline.

AppleHide My EmailSign in with Appleemail privacyiClouddeveloper operations

Apple's Tracking Prompt Now Runs on a Four-Month Clock

The Bundeskartellamt closed its case against Apple's App Tracking Transparency Framework with binding commitments: a neutral consent prompt, a seven-year monitoring trustee, and a four-month deadline to comply.

3 min read

Decisions

Apple Shrank Its Flagship Bet to Fund the Next One

Apple confirmed on August 21, 2026 that it cut over 200 jobs, about 100 from Vision Pro and 100 from Siri, trimming a shipped flagship product to fund an AI-capable Siri and reported smart glasses.

4 min read